Weak password recovery mechanism in osTicket by Enhancesoft LLC

Background

osTicket by Enhancesoft LLC is a free, open-source technical support ticket management system widely used by organizations of all sizes.

Description

A logic vulnerability exists in the password reset token validation routine of osTicket versions prior to v1.17.8 and v1.18.4. The application checks whether a reset token's validity window has expired, but the expiry check is only performed if the timestamp lookup fails.

This means that tokens with existing timestamps can bypass the expiration validation entirely. The root cause is a logical operator error: the code used a logical AND (&&) when it should have used OR (||), causing the validation to fail when both conditions were not simultaneously true.

Business impact

An attacker able to obtain a valid password reset token could reuse it indefinitely to perform an unauthorised password reset and compromise the affected account. Given the critical nature of helpdesk systems that often handle sensitive customer data and internal communications, this vulnerability poses a significant risk to confidentiality and integrity.

Systems affected

osTicket versions prior to v1.17.8 and v1.18.4.

Solution

Upgrade to osTicket v1.17.8 or v1.18.4, which correct the logical operator from && to || in the token validation routine.

Disclosure timeline

References

The information contained within this advisory is supplied 'as-is' with no warranties or guarantees of fitness of use or otherwise. Internet Security Auditors accepts no responsibility for any damage caused by the use or misuse of this information.